{"id":"CVE-2026-126544","kind":"vulnerability","aliases":["CVE-2026-126544"],"related":[],"title":"AVideo: email verification bypass lets users verify other accounts","description":"WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.","summary":"AVideo versions 6.5 through 29.7.1 have a flaw in the email verification code check, where PHP loose comparison of the recoverPass token can be exploited. A registered user can reuse the installation-wide salt from their own verification link to verify other accounts' emails and unlock features such as live streaming.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AVideo","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["avideo","other","php","self-hosted"],"not_affected_if":["versions-outside-range"],"how_to_check":"- Confirm the installed AVideo version is within 6.5 through 29.7.1.\n- Inspect `objects/user.php` for the `User::verifyCode()` function and its recoverPass comparison.","fix":null,"status":"open","published_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:26:00+00:00","updated_at":"2026-11-11T01:26:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T01:26:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AVideo: email verification bypass lets users verify other accounts","impact":"medium","summary":"AVideo versions 6.5 through 29.7.1 have a flaw in the email verification code check, where PHP loose comparison of the recoverPass token can be exploited. A registered user can reuse the installation-wide salt from their own verification link to verify other accounts' emails and unlock features such as live streaming.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker verifies other accounts and unlocks their features","analyst_note":"Read the linked patch (github.com) to find the fixed version and confirm the exploit conditions; the sources do not state a fixed version.","how_to_check":"- Confirm the installed AVideo version is within 6.5 through 29.7.1.\n- Inspect `objects/user.php` for the `User::verifyCode()` function and its recoverPass comparison.","plain_action":"","product_name":"AVideo","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"AVideo installations in the 6.5 through 29.7.1 range are exposed where users can register and verify email addresses. Sites on other versions, or that do not run AVideo, can skip it. The sources do not describe further configuration conditions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00118,"input_tokens":4653,"output_tokens":1429,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126544':12A,15A '-2026':11A,14A '29.7.1':27B,79C '6.5':25B,77C 'account':9A,66B,130C 'arbitrari':119C 'avideo':1A,16A,17B,23B,76C 'bypass':4A,84C 'caus':91C 'check':36B 'code':35B,117C 'comparison':40B,95C 'contain':80C 'craft':115C 'cve':10A,13A 'email':2A,33B,67B,82C,131C 'exploit':47B 'featur':70B,133C 'flaw':30B 'host':22B 'id':121C 'instal':55B,106C 'installation-wid':54B,105C 'let':5A 'link':62B,113C 'live':73B,136C 'loos':39B,94C 'objects/user.php':90C 'php':19B,38B,93C 'recoverpass':43B,98C,123C 'regist':49B,100C 'reus':52B,103C 'salt':57B,108C 'self':21B 'self-host':20B 'set':124C 'stream':74B,137C 'token':44B,99C 'true':126C 'unlock':69B,132C 'user':6A,50B,87C,101C,120C 'verif':3A,34B,61B,83C,112C 'verifi':7A,64B,128C 'verifycod':88C 'version':24B 'vulner':85C 'wide':56B,107C 'wwbn':75C","nicknames":[],"mitigations":[],"who_affected":"AVideo installations in the 6.5 through 29.7.1 range are exposed where users can register and verify email addresses. Sites on other versions, or that do not run AVideo, can skip it. The sources do not describe further configuration conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["avideo"],"ptokens":["avideo"],"labels":["avideo","medium","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126544':12A,15A '-2026':11A,14A 'account':9A 'avideo':1A,16A 'bypass':4A 'cve':10A,13A 'email':2A 'let':5A 'user':6A 'verif':3A 'verifi':7A","search_b":"'29.7.1':27B '6.5':25B 'account':66B 'avideo':17B,23B 'check':36B 'code':35B 'comparison':40B 'email':33B,67B 'exploit':47B 'featur':70B 'flaw':30B 'host':22B 'instal':55B 'installation-wid':54B 'link':62B 'live':73B 'loos':39B 'php':19B,38B 'recoverpass':43B 'regist':49B 'reus':52B 'salt':57B 'self':21B 'self-host':20B 'stream':74B 'token':44B 'unlock':69B 'user':50B 'verif':34B,61B 'verifi':64B 'version':24B 'wide':56B","search_c":"'29.7.1':79C '6.5':77C 'account':130C 'arbitrari':119C 'avideo':76C 'bypass':84C 'caus':91C 'code':117C 'comparison':95C 'contain':80C 'craft':115C 'email':82C,131C 'featur':133C 'id':121C 'instal':106C 'installation-wid':105C 'link':113C 'live':136C 'loos':94C 'objects/user.php':90C 'php':93C 'recoverpass':98C,123C 'regist':100C 'reus':103C 'salt':108C 'set':124C 'stream':137C 'token':99C 'true':126C 'unlock':132C 'user':87C,101C,120C 'verif':83C,112C 'verifi':128C 'verifycod':88C 'vulner':85C 'wide':107C 'wwbn':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T16:08:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126544","severity":null,"published_at":"2026-11-11T01:17:15+00:00","modified_at":"2026-11-11T01:17:16+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null}],"documents":[{"id":121300,"url":"https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121301,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T16:08:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":121302,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verifycode","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}